Deployment-time attacks, often called “adversarial examples” or “adversarial perturbations”, have been given a great deal of attention, especially against neural networks in recent years.
With a focus on graph neural-networks Entezari et al. similarly observed that attackers are generally are less effective in low dimensions ([1]}).
We direct the reader to [2]}, [3]}, [4]} for a general review and to [5]}, [6]} specifically for neural networks.
Others have developed attacks against and analyzed the robustness of \(k\) NN and other non-parametric methods [7]}, [8]}).
In contrast to our work, they model an attacker acting at deployment-time, not training-time.
